Add PAN-OS Authentication Bypass STIX bundle (CVE-2024-0012, CVE-2024-9474)

[kaluzaCSA]

Summary

This PR adds a comprehensive STIX 2.1 bundle documenting the PAN-OS authentication bypass vulnerabilities (CVE-2024-0012 and CVE-2024-9474) being actively exploited in Operation Lunar Peek campaign.

Contents

• Attack Pattern: PAN-OS Management Interface Authentication Bypass
• Vulnerabilities: CVE-2024-0012 (Critical) and CVE-2024-9474 (Medium)
• Course of Action: Cloud-specific mitigation guidance for AWS, Azure, GCP
• Intrusion Set: Operation Lunar Peek campaign details
• Indicator: Network detection pattern for exploitation attempts
• Relationships: 5 relationship objects connecting all components

Validation

• ✅ STIX 2.1 compliant (validated with stixvalidator.com)
• ✅ Proper UUIDv4 identifiers throughout
• ✅ CAVEaT cloud security extension framework
• ✅ Real-world threat intelligence based on active exploitation

Impact

This entry provides actionable threat intelligence for:

• Cloud security teams defending edge infrastructure
• Threat hunters looking for compromise indicators
• Security architects implementing cloud mitigations
• SIEM/SOAR platforms for automated detection and response

References

• CVE-2024-0012 Advisory
• CVE-2024-9474 Advisory
• Unit 42 Operation Lunar Peek Analysis